Page 3
Document Title Publication Number Summary of Changes Publication Date Advanced Web Tools User’s 53-0000522-04 Insistent Domain ID Mode. October 2003 Guide v4.1.2 Port Swapping information. Minor editorial changes. Advanced Web Tools 53-0000522-05 Updates to support new switch types: December 2003 Administrator’s Guide, v4.2.0 Brocade 3250, 3850, 24000.
Page 4
Document Title Publication Number Summary of Changes Publication Date Web Tools Administrator’s Guide 53-1001194-01 Updates to add support for Virtual November 2008 Fabrics, IPsec, and consistency with Brocade Network Advisor. Web Tools Administrator’s Guide 53-1001343-01 Updates to add support for Brocade July 2009 7800 Extension Switch, Brocade 8000, FCOE10-24 DCX Blade, and FX8-24...
Page 15
Enabling and disabling QoS priority-based flow control ..227 Enabling and disabling FCoE ports ......227 Chapter 18 Limitations General Web Tools limitations .
Page 16
Web Tools Administrator’s Guide 53-1002756-01...
Page 17
Figures Figure 1 Configuring Internet Explorer ......... 6 Figure 2 Default Java for browsers option .
Page 18
Figure 37 User tab ............165 Figure 38 Add User Account dialog box (VF) .
Page 19
Tables Table 1 Basic Web Tools features and EGM licensed features ..... 2 Table 2 Web Tools functionality moved to Brocade Network Advisor ....3 Table 3 Certified and tested platforms.
Page 20
Web Tools Administrator’s Guide 53-1002756-01...
• Chapter 11, “Using the Access Gateway” provides information on how to configure and manage the Brocade Access Gateway. • Chapter 12, “Administering Fabric Watch” provides information on how to use the Fabric Watch feature to monitor the performance and status of switches and alert you when problems arise. •...
• Switching between virtual fabrics • TACACS+ management • Setting a principal switch • Switch Status Policy changes • Forward Error Correction • Port Admin button grouping • Updated 'Setting a shared secret key pair' section to include HBA • Removed support for admin domain •...
Notes, cautions, and warnings The following notices and statements are used in this manual. They are listed below in order of increasing severity of potential hazards. NOTE A note provides a tip, guidance, or advice, emphasizes important information, or provides a reference to related information.
Additional information This section lists additional Brocade and industry-specific documentation that you might find helpful. Brocade resources To get up-to-the-minute information, go to http://my.brocade.com to register at no cost for a user ID and password. White papers, online demonstrations, and data sheets are available through the Brocade website http://www.brocade.com/products-solutions/products/index.page For additional Brocade documentation, visit the Brocade website: http://www.brocade.com...
• Serial console and Telnet session logs • syslog message logs 2. Switch Serial Number The switch serial number and corresponding bar code are provided on the serial number label, as illustrated below: *FT00X0054E9* FT00X0054E9 The serial number label is located as follows: •...
Page 28
xxviii Web Tools Administrator’s Guide 53-1002756-01...
Web Tools, the EGM license, and Brocade Network Advisor Web Tools features enabled by the EGM license Table 1 describes those Web Tools features that require the EGM license. TABLE 1 Basic Web Tools features and EGM licensed features Feature Basic Web Tools Web Tools with EGM License Active Directory support...
Web Tools, the EGM license, and Brocade Network Advisor TABLE 1 Basic Web Tools features and EGM licensed features (Continued) Feature Basic Web Tools Web Tools with EGM License Routing and DLS Configuration Security Policies Tab (like ACL) Switch Info tab Switch Status Switch View right-click options Trace dump...
System requirements TABLE 2 Web Tools functionality moved to Brocade Network Advisor (Continued) Function Web Tools 6.1.0 Brocade Network Advisor Comments FCIP Tunnel Port Admin Module > GigE Configure > FCIP Tunnel Viewing FCIP Configuration tunnels is still supported in Web Tools 6.1.1, but New, Edit Config, and delete are...
System requirements Brocade supports the platforms shown in Table TABLE 4 Supported platforms Operating System Browser Red Hat AS 4.0 (x86 32-bit) Firefox 12.0 RedHat Enterprise Linux 6.1 Adv (32-bit) SUSE Linux Enterprise Server 10 (32-bit) SUSE Linux Enterprise Server 11 (x86 32-bit) Windows 2000 Firefox 12.0, Internet Explorer 9.0 Windows 2003 Server, SP2...
System requirements FIGURE 1 Configuring Internet Explorer Deleting temporary internet files used by Java applications For Web Tools to operate correctly, you must delete the temporary internet files used by Java applications. To delete these files, perform the following steps. 1.
Java installation on the workstation Java installation on the workstation Java Plug-in must be installed on the workstation. If you attempt to open Web Tools without any Java Plug-in installed: • Internet Explorer automatically prompts and downloads the proper Java Plug-in. •...
Java plug-in configuration Installing the Java plug-in on Windows To Install the Java plug-in on Windows, perform the following steps. 1. From the Start menu, select Control Panel and select the Java Plug-in Control Panel. 2. Select the About tab. 3.
Value line licenses 1. From the Start menu, select Control Panel. 2. Click the Advanced tab and expand the Default Java for browsers option, as shown in Figure 2 on page 9. FIGURE 2 Default Java for browsers option 3. Select Mozilla family and click Apply. 4.
Opening Web Tools Opening Web Tools You can open Web Tools on any workstation with a compatible Web browser installed. For a list of Web browsers compatible with Fabric OS v7.1.0, refer to Table 3. Web Tools supports both HTTP and HTTPS protocol.
Opening Web Tools FIGURE 3 Web Tools interface Logging in When you use Web Tools, you must log in before you can view or modify any switch information. This section describes the login process. Prior to displaying the login window, Web Tools displays a security banner (if one is configured for your switch), that you must accept before logging in.
Page 40
Opening Web Tools 1. Click Run on the signed certificate applet. A warning dialog box may display. If you select the check box Always trust content from this publisher, the warning dialog box is not displayed when you open Web Tools again. 2.
Role-Based Access Control 2. Log in to a logical fabric. • To log in to the home logical fabric, select Home Logical Fabric and click OK. • To log in to a logical fabric other than the home logical fabric, select User Specified Logical Fabric, enter the fabric ID number or the context name, and click OK.
Session management TABLE 5 Predefined Web Tools roles (Continued) Role Description securityadmin You can perform actions that do not affect the stored configuration. switchadmin You can perform all actions on the switch, except the following: • You cannot modify zoning configurations. •...
Web Tools system logs Web Tools system logs Web Tools uses the log4j framework to write the logs into a file When you launch Web Tools for the first time, it automatically creates the following directories. These directories are created under Web Tools directory if they are not available: •...
Requirements for IPv6 support The default path for Windows is C:\Documents and Settings\<<user>>\Webtools\<log file>. The default path for Linux is /root/WebTools/<switch log file>. 3. Click Capture to start collecting the SupportSave logs. A zipped-up SupportSave folder is saved in the defined location. SupportSave zip file name format is “WT-SS-switchIP-dd-mm-yy-hh-mm-ss.zip”.
Chapter Using the Web Tools Interface In this chapter • Viewing Switch Explorer ......... 17 •...
Page 46
Viewing Switch Explorer NOTE To perform monitoring tasks such as performance monitoring the EGM license must be installed on the switch; otherwise, access to this feature is denied and an error message displays. Reporting tasks, such as viewing the status of a switch. Tools tasks, such as opening the Telnet or SSH client window, beaconing a switch or chassis, and access to technical SupportSave.
Viewing Switch Explorer Tabs and Fabric Tree Menu bar Switch View buttons Switch Events and Switch Information Indicator bar Professional Management Tool offering Switch View FIGURE 5 Switch Explorer Persisting GUI preferences Web Tools persists your GUI preferences across sessions for the Switch Explorer, Port Admin, Switch Admin, Name Server, and Zone Admin dialog boxes on all web-browser platforms.
Viewing Switch Explorer • Basic or Advance mode • Last selected tab by the user • Table column sorting • Table column positions The Switch Admin GUI preferences that persist are: • Basic or Advance modes • Last selected tab •...
Viewing Switch Explorer Although Fabric Tree displays all the switches in the fabric, you can manage switches that support Fabric OS v6.1 and later versions because it does not requires Web Tools license. If a switch is launched from Fabric Tree, preference will be given to IPv4, even though both IPv4 and IPv6 are configured for that particular switch.
Page 50
Viewing Switch Explorer When you mouse over a port, a yellow color toggling effect is available to identify the selected port. The port LEDs in the Switch View match the LEDs on the physical switch. However, the blink rate of the LEDs in the Switch View does not necessarily match the blink rate of the LEDs on the physical switch.
Viewing Switch Explorer Switch Events and Switch Information Switch Events and Switch Information display as tab forms under Switch View. The information in the Switch Information tab is polled every 60 seconds. NOTE You can click the column head to sort the events by a particular column, and drag the column divider to resize a column.
Displaying tool tips • RNID Type Type of the switch. Model Model of the switch. Tag of the switch. Sequence number Sequence number of the switch. Insistent Domain ID Current status of the Insistent Domain ID mode of the switch. Mode Manufacturer Manufacturer of the switch.
Right-click options Right-click options You can right-click a port to quickly perform some basic port administration tasks, as shown in Figure FIGURE 7 Right-click menu for ports (from Switch Explorer) The tasks are: • The Port Admin option displays the Port Admin tab. •...
Displaying switches in the fabric For these reasons, the time displayed in the port statistics tab might not be refreshed as expected. The counter time indicates only that “this statistics data is retrieved from the switch in this time period.” To ensure the correct information, the time field is updated along with the port statistics data after every refresh.
Opening a Telnet or SSH client window • If you receive an error when saving changes in the Switch Administration window, note the error messages, refresh the window, and make your changes again. Do not continue making changes without refreshing the window and determining which changes were saved correctly. •...
Collecting logs for troubleshooting To close the session, enter exit at the prompt and press the Enter key. Collecting logs for troubleshooting If you encounter problems using the Web Tools interface, collect Java logs for use in troubleshooting. From Microsoft Windows, perform this procedure. 1.
Chapter Managing Fabrics and Switches In this chapter • Fabric and switch management overview ......29 •...
Page 58
Fabric and switch management overview FIGURE 8 Switch Administration window, Switch tab, Basic mode With the exception of switch time, information displayed in the Switch Administration window is not updated automatically by Web Tools. To update the information displayed in the Switch Administration window, click the Refresh button.
Configuring IP and subnet mask information Opening the Switch Administration window Most of the management procedures in this chapter are performed from the Switch Administration window. To open the Switch Administration window, perform the following steps. 1. Click Configure > Switch Admin. The Switch Administration dialog box displays in basic mode, as shown in Figure 8 on page 30.
Configuring Netstat Auto Refresh Configuring Netstat Auto Refresh The Netstat Performance window displays the details about Ethernet management port statistics like the Interface, MTU, Met, RX-OK, RX-ERR, RX-DRP, RX-OVR, TX-OK, TX-ERR, TX-DRP, TX-OVR, and Flag. To configure Auto Refresh, perform the following steps. 1.
Configuring IP Filtering You can click Clear All to remove all of the syslog IP addresses from the table. 4. Click Apply. Configuring IP Filtering Web Tools provides the ability to control what client IP addresses may connect to a switch or fabric. To set up IP Filtering, perform the following steps.
Blade management Enabling or disabling a blade The Firmware Version columns display the firmware loaded onto each blade. A blade can have more than one firmware image loaded onto it. The Blade State column in the Blade tab pane indicates whether the blade is enabled. NOTE The blade state is always shown as enabled, even if you perform a blade disable operation.
Switch configuration 1. Open the Switch Administration window as described in “Opening the Switch Administration window” on page 31. 2. Select the Blade tab. 3. Click Set IP address. 4. Select a slot number from the list. 5. Enter the IP address, subnet mask, and Gateway IP address. 6.
Switch configuration 1. Open the Switch Administration window as described in “Opening the Switch Administration window” on page 31. 2. Select the Switch tab. 3. In the Switch Status section, click Enable to enable the switch or Disable to disable the switch. 4.
Switch configuration Changing the switch domain ID Although domain IDs are assigned dynamically when a switch is enabled, you can request a specific ID to resolve a domain ID conflict when you merge fabrics. To change the switch domain ID, perform the following steps. 1.
Switch restart 3. In the Principal Switch section, perform one of the following to set the switch as a principal switch. • Select Set as preferred Principal Switch - The switch is set as principal switch in the next fabric rebuild. •...
System configuration parameters 4. Click Apply. Performing a reboot To reboot the CP and execute the normal power-on booting sequence, perform the following steps. 1. Open the Switch Administration window as described in “Opening the Switch Administration window” on page 31. 2.
System configuration parameters TABLE 7 Switches that support WWN-based Persistent PID on Web Tools Platform Default switch Logical switch Area mode FICON mode Yes, if dynamic If 8-bit dynamic area addressing mode is DCX/DCX-4S is enabled in the enabled, FMS is DCX 8510-4 Enabled default switch.
System configuration parameters Datafield size The largest possible data field size (in bytes). The range of valid values is from 256 through 2112. Address mode Displays the addressing mode present in the switch. Sequence Level Select this box to enable frames of the same sequence from a particular group to be Switching transmitted together.
System configuration parameters 1. Open the Switch Administration window as described in “Opening the Switch Administration window” on page 31. 2. Disable the switch as described in “Enabling and disabling a switch” on page 35. 3. Select the Configure tab. 4.
Licensed feature management 1. Open the Switch Administration window as described in “Opening the Switch Administration window” on page 31. 2. Disable the switch as described in “Enabling and disabling a switch” on page 35. 3. Select the Configure tab. 4.
Licensed feature management To activate a license, perform the following steps. 1. Open the Switch Administration window as described in “Opening the Switch Administration window” on page 31. 2. Select the License tab and click Add. The Add License dialog box displays. 3.
High Availability overview Universal time-based licensing After v6.3.0, Web Tools supports universal time-based licensing. Each universal key is for a single feature, and can be used on any product that supports the feature, for a defined trial period. At the end of the trial period, the feature gets disabled.
High Availability overview 1. Select a Brocade DCX, DCX-4S, DCX 8510-4 or DCX 8510-8 platforms from the Fabric Tree. The Switch View displays. 2. Click the HA button in the Switch View. The High Availability dialog box displays. The High Availability window contains the following two tabs: •...
Event monitoring If the HA Status field displays HA enabled, Heartbeat Up, HA State not in sync, continue with step 3. 3. Click Synchronize Services. The Warning dialog box displays. 4. Click Yes and wait for the CPs to complete a synchronization of services, so that a nondisruptive failover is ready.
Page 76
Event monitoring • Alert • Critical • Error • Warning • Marginal • Notice • Information • Debug Table 8 lists the event message severity levels displayed on the Switch Events tab and explains what qualifies event messages to be certain levels. On the Switch Events tab, you can click Filter to launch the Event Filter dialog box.
Event monitoring Displaying Switch Events The Switch Events tab displays a running log of events for the selected switch. Switch events are polled and updated every 15 seconds; there is no refresh-on-demand option for switch events. For two-switch configurations, all chassis-related events are displayed in the event list of each logical switch for convenience.
Displaying the Name Server entries The filter is enabled and the window is refreshed to show the filtered information. Filtering events by message ID To filter events by message ID, perform the following steps. 1. Open the Switch Events tab as described in “Displaying Switch Events”...
Displaying the Name Server entries 1. In the Switch Explorer window, select Name Server. The Name Server tab displays. 2. To set an autorefresh rate for the Name Server entries, select the Auto Refresh check box in the Name Server window, and enter an auto-refresh interval (in seconds). The minimum interval is 45 seconds and the default interval is 60 seconds.
Physically locating a switch using beaconing Physically locating a switch using beaconing Use the Beacon button to physically locate a switch in a fabric. The beaconing function helps to physically locate a switch by sending a signal to the specified switch, resulting in an LED light pattern that cycles through all ports for each switch (from left to right).
Virtual Fabrics overview • Brocade DCX 8510-4 • Brocade DCX 8510-8 Virtual Fabrics cannot be configured or managed from Web Tools. Configuration and management is done from either the Brocade Network Advisor, or the Fabric OS command line interface. For information about configuring and managing Virtual Fabrics, refer to the Brocade Network Advisor User Manual if you are using Brocade Network Advisor, or Fabric OS Administrator’s Guide if you are using the Fabric OS command line interface.
Page 82
Virtual Fabrics overview 1. Select Port Admin tab. The Port Admin tab displays. Logical ports are displayed in the FC Ports Explorer tree structure. 2. To view logical port properties, expand the Logical Ports branch, and select a port. The General properties are displayed.
Restoring a configuration If you select USB as the configuration file source, the network parameters are not needed and are not displayed. You can skip to step 6. 6. Use the Fabric ID selector to select the fabric ID of the logical switch from which the configuration file is to uploaded.
Uploading and downloading from USB storage An info link is enabled when USB is chosen as the source of the configuration file. If you click info, an information message displays. 6. Enter the configuration file with a fully-qualified path, or select the configuration file in the Configuration File Name field.
Page 86
Performing a firmware download The download source can be located on the Network or a USB device. NOTE When you select the USB button, you can specify only a firmware path or directory name. No other fields on the tab are available. The USB button is available if the USB is present on the switch.
Port management overview Opening the Port Admin tab Select Port Admin tab in the Switch Explorer window. The Port Admin tab displays information about the ports on the switch. Refer to “Switch View” on page 21 for information about accessible ports.
Page 89
Port management overview • MTU Size • Compression Mode • Data L2COS Value • DSCP Data • IKE Policy Number • IPsec Policy Enabled • Keep Alive Timeout • MaximumCommunicationRate • MinimumCommunicationRate • MaxRetransmitRate • MinRetransmitRate • Metric • Pre-Shared key •...
Page 90
Port management overview • General—All ports View Details Rename Edit Configuration Enable/Disable (port) Persistent Enable/Persistent Disable (port) • SFP—Physical ports only (FC, CEE, and GbE) Basic information about the port equipment • QSFP—Quad Small Form-factor Pluggable ports Basic Information about the port. UnitNumber ChannelIndex DeviceTech...
Configuring FC ports The Controllable attribute is Yes, if your role gives you Modify permission for ports. If a port is controllable, all configuration functionality is enabled. Configuring FC ports With the FC Port Configuration wizard, you can configure allowed port types, port speed, and long distance mode for physical ports.
Configuring FC ports NOTE If you configure a disabled port as an EX-Port, the wizard displays the Enable Port after configuration check box. If you select the check box, the disabled port is automatically enabled after configuration; otherwise, the port remains in the same state after configuration. Allowed port types For FC ports, the Port Admin tab displays the following values relating to port type: Port Type...
Configuring FC ports • 300, 5300, and 5100 switches • Brocade VA-40FC • Brocade 8000 • Brocade 7800 For non-8 Gbps platforms, all functionality is available without EGM license. Ingress rate limit Ingress rate limiting is a licensed feature that requires the Adaptive Networking license. NOTE For Brocade 6520, ingress rate limit can be configured without Adaptive Networking (AN) and Server Application Optimization (SAO) licenses.
Assigning a name to a port • Brocade VA-40FC • Brocade 8000 To configure the ingress rate limit feature, perform the following steps. 1. Select View > Advanced. 2. In the Port Admin tab, select a port, or multiple ports, to configure. 3.
Port beaconing Port beaconing Individual FC ports can be set to beacon using the Port Admin tab. Port beaconing status displays in the Port Beaconing column. The Switch View reflects the port beaconing status by flashing the port amber and green for 2.5 seconds each, in an alternating pattern. To configure beaconing for an FC port, perform the following steps.
Persistent enabling and disabling ports NOTE If the Enable or Disable option is gray (unavailable), the port is already in the enabled or disabled state. For example, if the Enable option is unavailable, the port is already enabled. If you select multiple ports in both enabled and disabled states, both options are active. When you click either option, the action is applied to all selected ports.
Configuring NPIV ports 5. Select either Enable or Disable from the Persistent drop-down button. NOTE Persistent Enable or Disable is not supported in FMS mode. NOTE If the Enable or Disable option is gray (unavailable), the port is already in that state or FMS mode is enabled on the switch, the port is already in the enabled or disabled state.
Port activation 6. Set the number of logins to allow on the selected port and click OK. Click Enable to bring the port back online. Port activation Brocade switches come with a preset number of ports enabled. Additional ports can be enabled using the Ports on Demand (POD) licenses and the Dynamic Ports on Demand (DPOD) feature (for supported switches only).
Port activation TABLE 9 Ports enabled with POD licenses and DPOD feature (Continued) Switch name Enabled by Enabled with Ports on Demand Enabled with the Dynamic Ports on default licenses Demand feature Brocade 4016 0-7, 10-13 8, 9, 14, 15 Any available ports Brocade 300 8-15, 16-23...
Port activation 4. Click Enable DPOD to enable the licensing mechanism to be dynamic. If the button is labeled Disable DPOD, the licensing mechanism is already set to dynamic. The existing POD associations and assignments are set as the initial Dynamic POD associations.
Port swapping index Reserving and releasing licenses on a port basis NOTE The Dynamic PODs feature is supported on the Brocade 4018, 4020, and 4024 switches only. To reserve and release licenses on a port basis, perform the following steps. 1.
Port swapping index Port swapping In the Port Admin list view and detailed view, swapped ports are indicated with the “(Swapped)” label appended to the Port Index column and field (Figure 14). FIGURE 14 Port swapped label To swap ports, perform the following steps. 1.
Configuring BB credits on an F_Port 1. Select a port in the Switch View to open the Port Admin tab. 2. Select the FC Ports tab. 3. Select View > Advanced. 4. From the tree on the left, select the port you want to swap. 5.
Configuring ALPA Configuring ALPA PID is the address assigned to the host when it performs a login with a fabric. The 24 bits of the PID are built from three 1 byte fields. The most significant byte is the Domain ID, the second byte is the Area which that device belongs to, and the least significant byte is the ALPA.
Configuring port octet speed combination FIGURE 16 ALPA Map selection A dialog box launches listing the Port WWN to ALPA Map with the host. The Port WWN map automatically populates. FIGURE 17 ALPA Map dialog 9. Optional: Click Remove All to clear all of the Port WWN maps. Configuring port octet speed combination The Port Admin tab provides an option to set the Port Octet Speed Combination.
Page 107
Configuring port octet speed combination NOTE For FC8-32E and FC8-48E port blades, the port octet speed combination is Auto or Fixed 8G|4G|2G. You can change the octet combination for the octet associated with first eight ports of a blade or switch.
Configuring CSCTL Configuring CSCTL Unlike QoS Zone-based FC flow prioritization method, CSCTL enables the same SID/DID pair exchange frames with different priorities. To be able to prioritize a frame flow between two end nodes, Fabric OS v7.0.0 and later provide support for up to 32 Virtual Channels (VCs) per port.
Configuring compression and encryption 4. Select Disable from the CSCTL drop-down button. Configuring compression and encryption Encryption provides security for the frames while they are in-flight and Compression allows better bandwidth utilization over long distance. Total bandwidth supported per blade for encryption is 32 Gbps and compression is 64 Gbps.
Forward Error Correction Either of the following compression status is displayed in the General tab of the port. Enabled (Active) - Compression is enabled on a port and the configuration is Active. Enabled (Inactive) - Compression is enabled on a port and the configuration is Inactive. Disabled - Compression is not enabled on a port.
Page 111
Inband Management The Inband Management interface is protocol independent, so any traffic destined for these Inband Management interfaces is passed through the distribution point to the control processor. It is then handled on the control processor, according to the rules set forth for the normal management interface and following any security rules that may be in place on the control processor.
GigE port modes GigE port modes Web Tools allows you to set the GigE port mode for the FX8-24 DCX Extension Blades to 1G, 10G, or dual modes. To configure the GigE port mode, perform the following steps: NOTE You must install the FX8-24 DCX Extension Blade in a slot containing 10GE license to configure the mode.
Viewing trunk group information 1. Select a port in the Switch View to open the Port Admin tab. 2. Select the FC Ports tab. 3. From the tree on the left, select the switch name or slot name. 4. From the table, select the port that you want to trunk. You can select multiple ports from the table.
F_Port trunk groups • Trunk Index (applies only to F_Port trunking). • Trunking Enabled F_Port trunk groups F_Port trunking provides extra bandwidth and robust connectivity for hosts and targets connected by switches in Access Gateway mode. There are five general criteria for establishing F_Port trunking: •...
Page 116
F_Port trunk groups A trunk group is created, identified by the trunk index, and containing the port you selected. Select the trunk group you just created. Add Members becomes active. 8. Additional ports can be added by selecting a port from Ports for trunking table and then clicking Add Members.
Performance Monitor overview Advanced monitoring The Advanced Monitoring menu is an optionally licensed feature. To utilize the Advanced Monitoring feature you must have a Performance Monitor license installed and you must log in using an account with an admin, switchadmin, fabricadmin role, and properly configured user defined roles.
Page 119
Performance Monitor overview TABLE 11 Basic performance graphs Graph type Display description Port Throughput The performance of a port, in bytes per second, for frames received and transmitted. Switch Aggregate Throughput The aggregate performance of all ports on a switch. Blade Aggregate Throughput The aggregate performance of all ports on a port card.
Page 120
Performance Monitor overview TABLE 13 Supported port types for Brocade switches (Continued) Graph type Physical FC ports Logical FC ports GbE ports Switch Percent Utilization Port Snapshot Error SID/DID Performance SCSI Commands SCSI vs. IP Traffic The Blade Aggregate Throughput graph is supported only on the Brocade DCX and DCX-4S enterprise-class platforms.
Performance Monitor overview FIGURE 21 Accessing performance graphs User-defined graphs You can modify the predefined graphs to create your own customized graphs (refer to “Customizing basic monitoring graphs” on page 95 for more information). These user-defined graphs can be added and saved to canvas configurations. Canvas configurations A canvas is a saved configuration of graphs.
Opening the Performance Monitor window FIGURE 22 Canvas of six performance monitoring graphs Opening the Performance Monitor window To perform performance monitoring, you must use Web Tools with the EGM license; otherwise, access to this feature is denied and an error messages displays. To open the Performance Monitor window, perform the following steps.
Customizing basic monitoring graphs NOTE For the Brocade 300, 5100, 5300, 6510, 6520, VA-40FC, 7800 Extension, 8000, and the Encryption Switch, enter only a port number. 4. Click OK. The graph is displayed in a window in the Performance Monitor window. Customizing basic monitoring graphs You can customize some of the basic performance monitoring graphs to display information for particular ports.
Page 124
Customizing basic monitoring graphs FIGURE 23 Select Ports for customizing the Switch Throughput Utilization graph You can perform the following in the dialog box: a. Double-click the domain to expand the slot or port list. NOTE For the Brocade 8510-8, Brocade 8510-4, and Brocade DCX and Brocade DCX-4S enterprise-class platforms, click the plus (+) signs to expand the ports under each slot, as shown in Figure...
Advanced performance monitoring graphs Advanced performance monitoring graphs This section describes how to create the advanced performance monitor graphs listed in Table 12 on page 91. Because the procedure for creating these graphs differs depending on the type of graph, each type is described separately in the sections that follow. The advanced monitoring graphs are not supported for GbE ports.
Advanced performance monitoring graphs If you selected multiple EE monitors, SIDs, or PIDs, a confirmation dialog box displays, reminding you that one graph is opened for each selection. Click Yes to display the graphs. 8. When you close a graph, a dialog box asks if you want to save the monitor. If you click OK, the monitor is saved, and persists if the switch is restarted.
Tunnel and TCP performance monitoring graphs 3. Navigate to a switch > slot > port in the Port Selection List. 4. Click the port from the Port Selection List and drag it into the Enter/drag port field. 5. Optional: For the LUN per port graphs, enter a LUN number, in hexadecimal notation. For the Brocade Encryption Switch, you can enter up to eight LUN masks For the Brocade 5100, 5300, 300, 7800, and 8000, you can enter up to eight LUN masks For all other switches running Fabric OS 4.x or v5.x, you can enter up to two LUN masks.
Saving graphs to a canvas 4. In the Tunnel and TCP area at the bottom of the screen, select the required check boxes for the statistic you want to graph. Note that each column represents a different graph. 5. Click Options to set the display options for the graphs. •...
Adding graphs to an existing canvas 3. Select File > Save Current Canvas Configuration. The Save Canvas Configuration dialog box displays. 4. Enter a name and description for the configuration and click Save Canvas. A message displays, confirming that the configuration was successfully saved to the switch. Adding graphs to an existing canvas The following procedure assumes that a canvas is already created.
Page 130
Modifying graphs 1. Open the Performance Monitor window. 2. Select File > Display Canvas Configurations. The Canvas Configuration List displays. A message “No Canvas configuration to display” displays if there are no saved canvas configurations. 3. Select a canvas from the list and click Edit. The Performance Monitor Canvas: Canvas Name dialog box displays.
Zoning configurations LSAN zone requirements An LSAN zone enables device connectivity between fabrics connected in Fibre Channel Routing (FCR) configurations without forcing you to merge fabrics. Extension switches provide multiple mechanisms to manage interfabric device connectivity. Zones that contain hosts and targets that are shared between the two fabrics need to be explicitly coordinated.
Zoning management Setting the default zoning mode The default zoning mode has two options: • All Access—All devices within the fabric can communicate with all other devices. • No Access—Devices in the fabric cannot access any other device in the fabric. NOTE You should not change the default zone mode from No Access to All Access if there is no effective zone configuration and more than 120 devices are connected to the fabric.
Page 134
Zoning management FIGURE 24 Zone Administration window ATTENTION Any changes you make in the Zone Administration window are held in a buffered environment and are not updated in the zoning database until you save the changes. If you close the Zone Administration window without saving your changes, your changes are lost.
Zoning management The Member Selection List panel displays only physical FC ports. To verify whether you have any unzoned devices, you must use Brocade Network Advisor to analyze zone configurations. In the Member Selection List, you can diferentiate between node WWN and port WWN with their icons as shown in Figure 25 Figure...
Zoning management Refreshing Zone Administration window information The information displayed in the Zone Administration window is initially a snapshot of the contents of the fabric zoning database at the time the window is launched. Any changes you make to this window are saved to a local buffer;...
Zoning management To save the local zone changes, perform the following steps. 1. Make the zoning changes in the Zone Administration window. 2. Select Zoning Actions > Save Config. NOTE If you have made changes to a configuration, you must enable the configuration before the changes are effective.
Zoning management 1. Open the Zone Administration window as described in “Opening the Zone Admin window” page 104. 2. Select a format to display zoning members in the Member Selection List as described in “Selecting a zoning view” on page 109. 3.
Zoning management Renaming zone aliases The new alias name cannot exceed 64 characters and can contain alphabetic, numeric, and underscore characters. For more information on enabling the configuration, refer to “Enabling zone configurations” page 118. To change the name of a zone alias, perform the following steps. 1.
Zoning management To create a zone, perform the following steps. 1. Open the Zone Administration window as described in “Opening the Zone Admin window” page 104. 2. Select a format to display zoning members in the Member Selection List as described in “Selecting a zoning view”...
Zoning management The zone members for the selected zone are listed in the Zone Members list. 4. Highlight an element in the Member Selection List that you want to include in your zone, or highlight an element in the Zone Members list that you want to delete. 5.
Zoning management Select Zoning Actions > Save Config to save the configuration changes. Because no changes were made to the effective configuration, you do not need to enable the configuration. Deleting zones For information on enabling the configuration, refer to “Enabling zone configurations”...
Zone configuration and zoning database management NOTE All switches in the fabric must be running Fabric OS v6.4.0 or later and all the ports in the TI zones must be in the same failover mode. Optional: Repeat steps 5 and 6 to add more elements to your TI zone. 8.
Zone configuration and zoning database management Creating zone configurations To create a zone configuration, perform the following steps. After creating a zone configuration, you must explicitly enable it for it to take effect. For information on enabling the configuration, refer to “Enabling zone configurations”...
Zone configuration and zoning database management 5. Click the right arrow to add a configuration member or the left arrow to remove a configuration member. 6. Select Zoning Actions > Save Config to save the configuration changes. Renaming zone configurations The new name cannot exceed 64 characters and can contain alphabetic, numeric, and underscore characters.
Zone configuration and zoning database management NOTE You cannot delete a enabled configuration. 1. Open the Zone Administration window as described in “Opening the Zone Admin window” page 104. 2. Select the Zone Config tab. 3. Select the configuration you want to delete from the Name list and click Delete. 4.
Zone configuration and zoning database management The Disable Config warning message displays. 3. Click Yes to save and disable the current configuration. Displaying enabled zone configurations The enabled zone configuration screen displays the actual content of the single zone configuration that is currently enabled on the fabric, whether it matches the configuration that was enabled when the current Zone Admin session was launched or last refreshed.
Zone configuration and zoning database management 2. To identify the most recently effective zone configuration without saving or applying any changes you made in the Zone Administration window, select Print > Print Effective Zone Configuration in the Zone Administration window. NOTE If no zone is enabled, a message displays, indicating that there is no active zoning configuration on the switch.
Zone configuration and zoning database management 4. Click items in the list to select or unselect, and click Delete to delete the WWN from all the selected zoning elements. The WWN is deleted from the selected items in the Zone Admin buffer. Replacing a WWN in multiple aliases and zones This procedure enables you to replace a WWN throughout the Zone Admin buffer.
Best practices for zoning Clearing the zoning database Use the following procedure to disable the active zoning configuration, if one exists, and delete the entire zoning database. You must disable any active configuration before you can delete the zoning database. ATTENTION This action not only disables zoning on the fabric, but also deletes the entire zoning database.
Trace dumps How a trace dump is used The generation of a trace dump causes a CRITICAL message to be logged to the system error log. When a trace dump is detected, issue the supportSave command on the affected switch. This command packages all error logs, the supportShow output, and trace dump, and moves these to your FTP server.
Displaying switch information 5. Click Apply. Disabling automatic trace uploads If automatic uploading of a trace dump is disabled, you must manually upload the trace dump or else the information is overwritten when a subsequent trace dump is generated. To disable automatic trace uploads, perform the following steps. 1.
Displaying switch information Viewing detailed fan hardware status The icon on the Fan button indicates the overall status of the fans. For more information about the switch fan, refer to the appropriate hardware documentation. You can display status information about the fans, as shown in Figure FIGURE 29 Fan States window...
Displaying switch information The detailed temperature sensor states for the switch are displayed, as shown in Figure Viewing the power supply status The icon on the Power button indicates the overall status of the power supply status. For more information regarding switch power modules, refer to the appropriate hardware documentation. FIGURE 30 Power States window To view the power supply status, perform the following steps.
Defining Switch Policy FIGURE 31 Switch Report window To check the physical health of the switch, perform the following steps. 1. Select a logical switch from the Logical Switch drop-down list in the top-right corner of the Switch Explorer window. The selected switch displays in the Switch View.
Page 157
Defining Switch Policy Use this dialog box to set policy parameters for calculating the overall status of the switch. The policy parameter values determine how many failed or faulty units of each contributor are allowed before triggering a status change in the switch from “Healthy” to “Marginal” or “Down”. The existence of policies such as WWN, CP, and Blade might differ from platform to platform.
Port LED interpretation Port LED interpretation Switch View displays port graphics with blinking LEDs, simulating the physical appearance of the ports. One of the LEDs indicates port status; the other indicates port speed. For LED information, refer to the hardware documentation for the switch you are viewing. (The blink rate of the LEDs in the Switch View does not necessarily match the blink rate of the LEDs on the physical switch.) NOTE...
Supported switches for Fibre Channel Routing VEX-Port A virtual port that enables routing functionality through an FCIP tunnel. A VEX-Port is similar to an EX-Port. A device is shared between: • The backbone fabric and edge fabric 1 • Edge fabric 1 and edge fabric 2 •...
FC-FC routing management FC-FC routing management You can perform Fibre Channel Routing operations using Web Tools, Web Tools with the EGM license, and Integrated Routing license. You can manage FC-FC Routing through the FC Routing module. The FC Routing module has tabbed panes that display EX-Ports, LSAN fabrics, LSAN zones, LSAN devices, and general FCR information.
Viewing EX-Ports 1. Select a logical switch from the Logical Switch drop-down list in the top-right corner of the Switch Explorer window. The selected switch displays in the Switch View. 2. Click Configure > FCR. The FC Routing module displays. If FC-FC Routing is disabled, a message to that effect displays on all the tabs in the module.
Configuring an EX-Port • Enable or disable trunking • Configure router port cost ATTENTION During EX-Port configuration, the port is automatically disabled, and then re-enabled when the changes are applied. Be sure that you do not physically connect a port to a remote fabric before configuring it as an EX-Port;...
Configuring FCR router port cost NOTE If you decide to configure a disabled port, the wizard provides the Enable Port after configuration check box. If you select this check box, the disabled port is automatically enabled after configuration. If you leave this box cleared, the port remains in the same state after configuration.
Configuring the backbone fabric ID Click the Physical Devices or Proxy Devices element in the tree to see a detailed list of the physical or proxy devices. Click the device name in the tree for more detailed information about a specific device.
Page 166
Configuring the backbone fabric ID Web Tools Administrator’s Guide 53-1002756-01...
Access Gateway mode FIGURE 33 Switch Explorer view for Access Gateway mode The Access Gateway mode Switch Explorer is divided into the following areas: • Menu bar • Switch View buttons • Switch View, Port Admin, and Access Gateway Devices tabs •...
Enabling Access Gateway mode Restricted access in the Port Admin tab When Access Gateway mode is enabled, the following options can be configured in access gateway mode: • Port Configuration Policy — You can select Auto or Advanced mode (default mode). When auto mode is selected, options like Trunking, Configure N-Port Groups, Configure F-N Port Mappings, and N Port configuration are disabled.
Port configuration Creating port groups You can group a number of N_Ports (and its mapped F_Ports) together to connect to multiple independent fabrics or to create performance optimized ports. To group a number of ports, you must create a new port group and assign desired N_Ports to it. The N_Port grouping option is enabled by default, and all N_Ports are members of a default port group 0 (pg0).
Port configuration Upon selecting the Login Balancing check box, the F Port Auto Rebalancing and N-Port Auto Rebalancing check boxes and Manual Balancing button become enabled. 6. Click Failover Enable. A confirmation dialog box displays. Click Yes to enable failover to all the ports in the port group or click No if you do not want to enable failover.
Port configuration 4. Select the Primary Mappings subtab on the right side of the dialog. 5. In the Primary Mappings area, select ports and use the Add (right arrow) button to map F_Ports or U_Ports to N_Ports. 6. Optional: Use the Remove (left arrow) button to delete an F_Port mapping from an N_Port. Optional: Define a secondary N_Port in the Secondary Failover Mappings area, by selecting the ports using the Add and Remove buttons to set up the secondary mappings.
Access Gateway policy modification 6. Optional: Expand the port in the right page and select the WWN and then use the Remove (left arrow) to remove the mapping. Optional: Define a failover in the Secondary Failover Mappings area, by selecting the ports using the Add and Remove buttons to set up the secondary mappings.
Page 175
Access Gateway policy modification NOTE When port configuration is in auto mode, the Configure N port groups, Configure F-N port mapping, and Configure WWN-N port mapping buttons are disabled. To enable auto rebalancing from the Switch Administration window, perform the following steps. 1.
Access Gateway limitations on the Brocade 8000 • Click Manual Balancing and a confirmation dialog box displays. Click Yes to change F Port-N Port Mapping or click No to cancel the changes. Click Apply to apply the changes. Access Gateway limitations on the Brocade 8000 The following list the is a compilation of the limitations of using Access Gateway with the Brocade 8000 switch: •...
Chapter Administering Fabric Watch In this chapter • Fabric Watch overview......... . 149 Fabric Watch overview Fabric Watch is an optional Brocade licensed feature that monitors the performance and status of switches.
Page 178
Fabric Watch overview Web Tools Administrator’s Guide 53-1002756-01...
Chapter Administering Extended Fabrics In this chapter • Extended link buffer allocation overview ......151 •...
Page 180
Extended link buffer allocation overview • Buffer Needed—The number of buffers needed. You can edit the buffer needed for LD and LS modes. When you change Buffer Needed value, Frame Size and Desired Distance(km) value cannot be changed. • Buffer Allocated—The number of buffers actually allocated. •...
Page 181
Extended link buffer allocation overview FIGURE 35 Extended Fabric tab For the Brocade DCX, DCX-4S, DCX 8510-4, and DCX 8510-8 the slots for CPs are not available. The Brocade Encryption Switch and the FS8-18 Encryption blade support auto-negotiated link speeds of 1, 2, 4, and 8 Gbps. TABLE 15 Long-distance settings and license requirements Value...
Configuring a port for long distance TABLE 15 Long-distance settings and license requirements (Continued) Value Description Extended Fabrics License Required? Dynamic setting is enabled. Buffer credits for the given E_Port are dynamically configured based on the actual link distance, as long as this is less than the desired distance.
Page 183
Configuring a port for long distance • If the port capability is 4 GB, type a number between 10 and 125, inclusive. • If the port capability is 2 GB, type a number between 10 and 250, inclusive. • If the port capability is 1 GB, type a number between 10 and 500, inclusive. •...
Page 184
Configuring a port for long distance Web Tools Administrator’s Guide 53-1002756-01...
Viewing fabric shortest path first routing FIGURE 36 Routing tab Viewing fabric shortest path first routing The Routing tab of the Switch Administration window displays information about routing paths. To view the fabric shortest path first routing, perform the following steps. 1.
Configuring dynamic load sharing Configuring dynamic load sharing The exchange-based routing policy depends on the Fabric OS dynamic load sharing feature (DLS) for dynamic routing path selection. When this policy is in force, DLS is always enabled and cannot be disabled. When the port-based policy is in force, you can enable DLS to optimize routing.
Specifying frame order delivery You can enable this loss less feature from WT. If you try to enable loss less when DLS is OFF, an error message displays. To enable or disable loss less DLS, perform the following steps. 1. Open the Switch Administration window as described in “Opening the Switch Administration window”...
Page 189
Configuring the link cost for a port Every ISL has a default cost that is inversely proportional to its bandwidth. Use this procedure to set a non-default, “static” cost for any port. 1. Open the Switch Administration window as described in “Opening the Switch Administration window”...
Page 190
Configuring the link cost for a port Web Tools Administrator’s Guide 53-1002756-01...
User-defined accounts The User tab of the Switch Administration window (Figure 37 on page 165) displays account information. You can create and manage accounts depending on your role. The roles and permissions are listed in Table TABLE 16 User role and permissions Role Permissions admin...
User-defined accounts FIGURE 37 User tab Viewing user account information To view user account information, perform the following steps. 1. Open the Switch Administration window as described in “Opening the Switch Administration window” on page 31. 2. Select the User tab. A list of the default and user-defined accounts displays.
Page 194
User-defined accounts FIGURE 38 Add User Account dialog box (VF) 4. Enter the user name. The user name must begin with an alphabetic character. The name can be up to 40 characters long. It is case-sensitive and can contain alphabetic and numeric characters, the dot (.) and the underscore (_).
User-defined accounts Selecting All makes the target user account a physical fabric administrator. 11. Select a home logical fabric ID if Virtual Fabrics are enabled. The default home logical fabric ID is 128. 12. For Virtual Fabrics environments, select a Chassis Role. The chassis role determines the RBAC role and permissions of the user for performing all chassis-level operations in all logical fabrics.
User-defined accounts You can change the description only on user-level accounts. You cannot change the description of the default accounts. You cannot change the description of your own account. Click Enabled or Disabled to enable or disable the account. You can enable and disable user- and admin-level accounts, but not your own account. You cannot enable or disable your own account or the factory account.
Page 197
User-defined accounts The Set User Account Password dialog box displays. 5. Enter the current password of the account. This step is required only if you are changing the password of your own or a peer admin account. 6. Enter the new password of the account. The new password must have at least one character different from the old password.
User-defined roles 1. Open the Switch Administration window as described in “Opening the Switch Administration window” on page 31. 2. Select the User tab. 3. Select the account. 4. Click Expire Password. If the button is unavailable, the password is already expired. 5.
User-defined roles • In order for the user-defined role to be able to edit the Port Admin and FCR configuration, you must assign the RBAC_SwitchPortManagement and RBAC_SwitchPortConfiguration RBAC classes to the role. • In order for the user-defined role to be able to set the Fabric ID, you must assign the RBAC_FabricRouting and RBAC_SwitchConfiguration RBAC classes to the role.
User-defined roles FIGURE 39 Switch Admin:Add User Defined Role dialog 5. Enter a role name in the Name field. 6. Enter a description of the role in the Description field. To grant the role a read/write privilege, select the privilege and click the right-arrow next to the Read &...
Access control list policy configuration The Switch Admin:Edit User Defined Role dialog box displays. FIGURE 40 Switch Admin:Add User Defined Role dialog 6. To grant the role a read/write privilege, select the privilege and click the right-arrow next to the Read &...
Access control list policy configuration Virtual Fabrics considerations ACL policies can be implemented at the logical switch/logical fabric level. Creating an SCC, DCC, or FCS policy You can create the FCS policy only once. To create an SCC, DCC, or FCS policy, perform the following steps. 1.
Access control list policy configuration 8. Select a switch or highlight multiple switches to add to the policy by clicking Add or Add All. 9. Select a switch or highlight multiple switches to remove a policy by clicking Remove. 10. Click Next and click Finish to confirm the changes to the switch. Deleting all SCC, DCC, or FCS policies You cannot delete the FCS policy from non-primary or non-FCS switches.
Access control list policy configuration 4. Click Distribute Policy. 5. Select the switches that will receive the policy. 6. Select OK. If the policy distribution fails, an error dialog box displays. Moving an FCS policy switch position You can move the position of a primary switch in the FCS policy list. To move an FCS policy switch position, perform the following steps.
Authentication policy configuration 8. Click Close. Authentication policy configuration You can configure an authentication protocol policy for E_Port and F_Port authentication, and then distribute the authentication policy to other switches in the fabric. You can also set shared secret keys. Configuring authentication policies for E_Ports To configure authentication policies for E_Ports, perform the following steps.
Authentication policy configuration 5. Set the switch authentication mode to either off or passive and click Apply. Distributing authentication policies Authentication policies are distributed only if all the selected switches accept the distribution. Only the policy mode is distributed to the selected switches. The switch initiating the distribution must accept distribution.
SNMP configuration 6. Enter the Switch or HBA WWN, name, or domain ID, or use the Browse button to select a switch. In the Peer Secret and Confirm Peer Secret fields, enter the peer secret value. 8. In the Local Secret and Confirm Local Secret fields, enter the local secret value. 9.
SNMP configuration 1. Open the Switch Administration window as described in “Opening the Switch Administration window” on page 31. 2. Select the SNMP tab. 3. Select a trap level for a recipient from the corresponding Trap Level menu in the SNMPv1 and SNMPv3 sections.
RADIUS management 3. Select a user name from the User Name menu in the SNMPv3 section. NOTE The list is scrollable. If you do not see your user name, scroll down using the scroll bar or by clicking the User Name heading. 4.
RADIUS management The following are the three choices in the drop-down menu when RADIUS is selected as the primary service: • Switch Database when RADIUS Authentication Fails—When selected, the switch user login database is checked whenever RADIUS authentication fails. • Switch Database When RADIUS Times Out—Switch user login database is checked only if the physical connection to the RADIUS server fails.
RADIUS management You can configure RADIUS even if it is disabled. You can configure up to five RADIUS servers. You must be logged in as admin, switchadmin, or securityadmin to configure RADIUS. To configure RADIUS, perform the following steps.. 1. Open the Switch Administration window as described in “Opening the Switch Administration window”...
Active Directory service management Modifying the RADIUS server order The RADIUS servers are contacted in the order they are listed, starting from the top of the list and moving to the bottom. To modify the RADIUS server order, perform the following steps. 1.
Active Directory service management 1. Open the Switch Administration window as described in “Opening the Switch Administration window” on page 31. 2. Select the AAA Service tab. 3. To enable Active Directory service, select Active Directory from the Primary AAA Service menu. 4.
TACACS+ management TACACS+ management TACACS+ provides user authentication and authorization using TACACS as authentication protocol. You can add, remove, and modify settings of TACACS+ Server. Enabling and disabling TACACS+ At least one TACACS+ server must be configured before you can enable TACACS+. To enable or disable TACACS+, perform the following steps.
IPsec concepts 1. Open the Switch Administration window as described in “Opening the Switch Administration window” on page 31. 2. Select the AAA Service tab. 3. Select a server from the TACACS+ Configuration list. 4. Click Modify. The RADIUS/ADLDAP/TACACS+ Configuration dialog box displays. 5.
IPsec concepts There are several protocols and algorithms that can be applied. Choosing the protocols and algorithms you want to use may be a matter of adapting to an implementation that is already in place in your LAN, or you may need to do a significant amount of research and planning. The supported protocols and algorithms are defined and described in the RFCs listed in Table TABLE 17...
IPsec concepts FIGURE 41 Transport mode and tunnel mode comparison IPsec header options IPsec adds headers to an IP datagram to enable authentication and privacy. There are two options: • Authentication Header (AH) • Encapsulating Security Payload (ESP) Authentication Header AH can be used to authenticate a data stream, but does not provide encryption needed for privacy.
IPsec concepts Encapsulating Security Payload ESP provides authentication, and also provides privacy by encrypting the IP datagram. The use of an ESP header is similar to the use of the AH header. A hash algorithm is used to calculate an authentication value, the authentication value is sent in an IP datagram, and the same hash algorithm is used by the receiver to verify the authentication value.
IPsec concepts Gateway to Gateway In a gateway to gateway configuration, IPsec protection is implemented between network nodes. Tunnel mode is commonly used in a gateway to gateway configuration. A tunnel endpoint represents a set of IP addresses associated with actual endpoints that use the tunnel. IPsec is transparent to the actual endpoints.
Page 221
IPsec concepts Hash algorithms Hash message authentication codes (HMAC) check data integrity through a mathematical calculation on a message using a hash algorithm combined with a shared, secret key. Table 19 lists the available encryption algorithms. The sending computer uses the hash function and shared key to compute a checksum or code for the message, and sends it to the receiving computer.
IPsec over management ports DH group choices are 1(modp768), 2(modp1024), 14(modp2048), and 18(modp8192). Each group provides an incrementally more secure key exchange by providing more bits (768, 1024, 2048, 8192). Authentication methods The methods used to authenticate the IKE peer are preshared key (psk), DSS digital signature (dss), and RSA digital signature (rsasig): •...
IPsec over management ports 1. Open the Switch Administration window. 2. Select Show Advanced Mode. 3. Select the Security Policies tab. 4. Under Security Policies, select Ethernet IPsec. The Ethernet IPsec Policies screen displays. 5. Ethernet IPsec policies can be configured only after enabling IPsec by clicking the Enable button below the Ethernet IPsec policies table.
IPsec over management ports To create a security association, perform the following steps. 1. Select the IPsec tab. The IPsec Policies screen displays. 2. Select the SA tab. 3. Select Add. The Add SA dialog box displays. 4. Enter a name for the SA in the SA Name field. 5.
IPsec over management ports The SA lifetime may be defined as a time value in seconds (LifeTime in seconds), as the number of bytes transmitted before the SA is rekeyed (LifeTime in bytes), or both. When both are used, the SA lifetime is determined by the threshold that is first reached. 6.
IPsec over management ports The Add Selector dialog box displays. 3. Enter a name in the Selector Name field. 4. Select the Traffic Flow Direction (in or out). IPsec policies are unidirectional, and must be applied separately to inbound and outbound flows.
IPsec over management ports The choices are ah (for authentication header) and esp (for encapsulated security protocol). 10. Select the IPsec Protection Type option. 11. Select the Authentication Algorithm option. 12. Enter or copy a generated encryption key in the Encryption Key field. 13.
Establishing authentication policies for HBAs Establishing authentication policies for HBAs To establish and enable authentication policies for HBAs as the log in to a fabric, perform the following steps. 1. Open the Switch Administration window. 2. Click Show Advanced Mode. 3.
Enabling port-based routing • Install a FICON CUP license on the Brocade switch. • Configure CUP attributes (FMS parameters) for the FICON director. FMS mode enable failed due to ports with areas 0xFE or 0xFF are connected to devices. You can use Web Tools for all of these tasks. You can also use Web Tools to manage FICON directors (when FMS mode is enabled on those directors) to do the following: •...
Enabling or disabling FICON Management Server mode Enabling or disabling FICON Management Server mode FICON Management Server (FMS) is used to support switch management using CUP. To be able to use the CUP functionality, all switches in the fabric must have FICON Management Server mode (FMS mode) enabled.
FMS parameter configuration TABLE 20 FMS mode parameter descriptions Parameter Description Programmed Controls whether host programming is allowed to set the switch offline. The parameter is set Offline State as enabled by the hardware after system installation, and can be reset by Web Tools. Control Active=Saved Controls the IPL file update.
Displaying code page information 3. Select the FICON CUP tab. The FICON CUP page displays the FICON Management Server page. All attributes on this page are read-only until FMS mode is enabled. 4. To enable or disable an FMS mode parameter, click the check box next to the parameter. A checked check box indicates that the parameter is enabled.
Allow / Prohibit Matrix configuration • Mode Register • Port Names (also called Port Address Name) • Allow/Prohibit Matrix and Port Connectivity Attributes • Switch enable/disable • Switch name change To access the FICON CUP tab, perform the following steps. 1.
Allow / Prohibit Matrix configuration The Port Connectivity table (shown in Figure 45 on page 209) displays the Port number (in physical-location format), Port Name (port address name), Block attribute, Prohibit attribute, and Area Id (port address, displayed in hexadecimal) in fixed columns. The right side is a port matrix, that lists all ports by Area ID and identifies prohibited ports.
Page 236
Allow / Prohibit Matrix configuration The Allow / Prohibit Matrix Configuration dialog box displays all ports and port names on the selected switch (similar to the dialog box shown in Figure 45). The Block column, Prohibit column, and prohibited ports matrix are displayed as empty, for you to configure. •...
Allow / Prohibit Matrix configuration FIGURE 45 Allow / Prohibit Matrix Configuration dialog box Activating an Allow / Prohibit Matrix configuration When you activate a saved Allow / Prohibit Matrix configuration on the switch, the preceding configuration (currently activated) is overwritten. To activate an Allow / Prohibit Matrix configuration, perform the following steps.
CUP logical path configuration 3. Click Copy. The Allow / Prohibit Matrix Configuration dialog box displays. 4. In the dialog box, enter a name and description for the new configuration and click OK to save the configuration to the target file; click Cancel to cancel copying the configuration. The file name must be in alphanumeric characters and can contain only dashes or underscores as special characters.
Link Incident Registered Recipient configuration The FICON CUP page displays the FICON Management Server page in front. All attributes on this page are read-only until FMS mode is enabled. 5. Click the CUP Logical paths subtab. 6. Select a logical path and click Set Current. Link Incident Registered Recipient configuration The Link Incident Registered Recipient (LIRR) receives Link Incident Reports (RLIR) on the source N_Port.
Displaying Request Node Identification Data Displaying Request Node Identification Data Web Tools displays Request Node Identification Data (RNID) information for the local switch, and for attached FICON devices and FICON channel paths. RNID information for the switch displays in the Switch Information tab (Figure 46).
Web Tools, the EGM license, and Brocade Network Advisor A limited set of features is accessible using Web Tools without a license, and is available free of charge. Additional switch management features are accessible using Web Tools with the Enhanced Group Management (EGM) license.
Switch administration and FCoE Switch administration and FCoE The DCB tab on the Switch Administration window is specific to DCE and DCB configuration and management. The DCB tab has five subtabs (Figure 47) that are used for FCoE switch administration: •...
Quality of Service configuration • You can edit the DCB map. The DCB map defines priority and priority group tables that support Enhanced Transmission Selection (ETS). ETS allows allocation of bandwidth to different traffic classes. DCB maps also allow you to enable Priority Flow Control (PFC). •...
LLDP-DCBX configuration 1. Select the DCB tab on the Switch Administration window. 2. Select the QoS tab. 3. Select the Traffic Class Map tab. 4. Select Add. The Traffic Class Map Configuration dialog box displays. NOTE This dialog box has the same structure as the Priority Group Map in the DCB Configuration dialog box.
Page 246
LLDP-DCBX configuration The Hello value sets the interval between hello bridge protocol data units sent by the root switch configuration messages. The range of valid values is from 4 to 180 seconds. The default is 30 seconds. 9. In the Multiplier field, set the number of consecutive misses allowed before LLDP considers the interface to be down.
LLDP-DCBX configuration Adding an LLDP profile The LLDP profile determines LLDP settings per port. To add an LLDP profile, perform the following steps. 1. Select the DCB tab on the Switch Administration window. 2. Select the LLDP-DCBX tab. 3. Select the LLDP Profile tab. 4.
Configuring DCB interfaces • management-address—The IP address of the management port on the 8000 switch. Advertise dot1-tlv—Advertises to any attached device to send IEEE 802.1 LLDP type, length, and values. Advertise dot3-tlv—Advertises to any attached device to send IEEE 802.3 LLDP type, length, and values.
Configuring a link aggregation group 8. Enter the profile name in the LLDP-DCBX Profile field for using a specific profile for the interface. 9. In the FC0E Priority Bits field, enter a value that indicates the desired user priority. Each bit represents a user priority that is associated with FCoE traffic.
Configuring VLANs The L2 mode setting determines operation within a VLAN: Access mode allows only one VLAN association, and all frames are untagged. Trunk mode allows more than one VLAN association, and allows tagged frames. 9. Select the operational Status. The choices are Administratively Up and Administratively Down.
Configuring FCoE login groups NOTE The FCoE check box is selected by default for FCoE VLAN. The FCoE check box is read-only, you must use the CLI to make any changes to the FCoE VLAN. 11. Click OK to enable FCoE. Clear the check box to disable FCoE. Configuring FCoE login groups FCoE login groups control which FCoE devices are allowed to log in to a switch or fabric.
Displaying LAG information 1. Select the FCoE Ports tab on the Port Admin tab. The initial view displays a summary of all FCoE ports on the switch (Figure 48). FIGURE 48 FCoE Ports tab, Port Administration panel 2. To view information for a specific port, select the trunk in the FC E Ports Explorer or select the port in the FCoE Port Configuration and Management table and click View Details.
Displaying VLAN information Displaying VLAN information To display VLAN information, perform the following steps. 1. Select the DCB tab on the Switch Administration window. 2. Select the VLAN tab. The VLAN information displays. Displaying FCoE login groups To display FCoE login group information, perform the following steps. 1.
Configuring a DCB interface from the Switch View • Toggle between showing Absolute Values or Delta Values (values that have changed since the last data collection). • Use the Clear Counters button to clear the counters in port statistics. • Change the retrieval interval.
Enabling and disabling LLDP 3. Click Add. The LAG Configuration dialog box displays. 4. Change the Status to Administratively Up or Administratively Down. Enabling and disabling LLDP To enable or disable LLDP on a DCB interface, perform the following steps. 1.
Page 256
Enabling and disabling FCoE ports Web Tools Administrator’s Guide 53-1002756-01...
Chapter Limitations In this chapter • General Web Tools limitations ........229 General Web Tools limitations Table 21 lists general Web Tools limitations that apply to all browsers and switch platforms.
Page 258
General Web Tools limitations TABLE 21 Web Tools limitations (Continued) Area Details Firmware download There are multiple phases to firmware download and activation. When Web Tools reports that firmware download completed successfully, this indicates that a basic sanity check, package retrieval, package unloading, and verification was successful. Web Tools forces a full package install.
Page 259
General Web Tools limitations TABLE 21 Web Tools limitations (Continued) Area Details Loss of Connection Occasionally, you might see the following message when you try to retrieve data from the switch or send a request to the switch: Switch Status Checking The switch is not currently accessible.
Page 260
General Web Tools limitations TABLE 21 Web Tools limitations (Continued) Area Details Refresh option in If you change the switch name using the Web Tools Switch Administration page or browsers SNMP and then open a Telnet window to verify the name change, the CLI prompt (for example, switch:admin >) displays the previous name.
Page 261
Index Numerics 2 domain/4 domain fabric licenses backbone fabric ID, configuring 7800 switch backing up configuration file basic performance monitoring graphs BB credit beaconing, enabling best practices for zoning Access Control List. Refer to ACL blades, enabling and disabling access control. Refer to RBAC. browsers Access Gateway mode limitations...
Page 262
configuring deleting Allow / Prohibit Matrix Allow / Prohibit Matrix configuration arbitrated loop parameters user accounts backbone fabric ID zone aliases default heap size zone configurations EX_Ports zones fabric parameters device probing FAN frame notification parameters devices only view FC ports devices only zoning FCR router cost disabling...
Page 263
enabling FCS policy Access Gateway mode activate automatic trace dump transfer create beaconing deactivate blades delete distribute FICON Management Server mode moving switch position insistent domain ID mode feature licenses ports FICON Management Server Ports on Demand mode, enabling and disabling RADIUS parameters RLS probing...
Page 264
installing media type Java Plug-in GigE message severity levels JRE patches on Solaris MetaSAN Solaris patches modifying Internet Explorer 7.0 performance graphs IOD, frame delivery RADIUS server IP address RADIUS server order filtering zone aliases ISL trunking zone configurations zones monitoring performance mouse over information Java Plug-ins...
Page 265
polling rates removing port menu licenses RADIUS server port names, assigning zone alias members port speed, configuring zone configuration members port swapping zone members port type, configuring renaming port-based routing zone aliases ports zone configurations buffer-limited zones configuring replacing a WWN in zoning database disabling requirements, Web Tools enabling...
Page 266
switch viewing 7800 EX_Ports changing the name of LSAN devices enabling and disabling LSAN fabrics mouse over information LSAN zones rebooting swapped ports Switch Administration window Switch Explorer switch status opening viewing FCR router cost Switch Events and Switch Information virtual channel settings, configuring switch events, displaying switch name, changing...
Page 267
zones about adding WWNs best practices creating deleting description LSAN modifying removing WWNs renaming replacing WWNs selecting a view zoning all access default zoning no access zoning database clearing maximum size zoning views zoning, disabling zoning, saving changes Web Tools Administrator’s Guide 53-1002756-01...
Page 268
Web Tools Administrator’s Guide 53-1002756-01...
Need help?
Do you have a question about the StoreFabric SN6500B and is the answer not in the manual?
Questions and answers